7b7791e313d975568016fc687adc20b1723f9b82883e2b379897b831a18070f2

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c9d76fc141de0a151cadb3ac5f3af9_JaffaCakes118.html
Size

16KB
MD5

03c9d76fc141de0a151cadb3ac5f3af9
SHA1

aefc59d840a0db4be336551ef3a4bb32aa499136
SHA256

7b7791e313d975568016fc687adc20b1723f9b82883e2b379897b831a18070f2
SHA512

e8eddeebbe651c20cfd370ab997a62a25b81eeca370c9d5d529d3e9e9b642c911011ebf22d404924d8cd0708c2c39e571ece09ec777521f32e869851816b4832
SSDEEP

192:gAjSZ4/BwOJAS+CDT5BEZXLAY0UArdxsUOka/arDh2SDbMrHT/7LPVXHRUJz+KVq:LDw9RCDBnxsy7iD7LdXxu6dI5nG93lt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420419474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07125edf398da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c11b5ac7780a5bc55b3dd5a1e81715232d8d7e78a31d19a06f738503b3698bdf000000000e800000000200002000000005c7f8051862652c3b5cfa9219ed1a7359f88bca85e97c675411222e873ac61890000000cac4f1da233b0e6568886038d861f9ebf366d0e53f227761e7322424c3ec1812aff483eda2b37581a962ed647e3b2cb46f6a28620466dc800e71023cada88ef5d1cf9984473f13650a30032b922d44b68f4f2ed0485c6381dfe700fc2eb0add217e1324526ce61896c338aa1d198cb38d2b98f79e7ab7cecdcc26bf9de7887dede80ca292e7385146fad8d165fbad17140000000ad41bc2bed1f9ccc17c314c03651b2f8dcbe95eeb02640993b91199bb6548eb0a01ea5c00c69d4c6c55a4f8b318c02df4e3579924884a5f800f7d8b99c7fd5ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ffe105b0a90637a6ae997a6b02fe9a77f8a80528b6ab92a67b938c8a2b934e9e000000000e8000000002000020000000096e10c39aacc358cf2123576e6f49920519abc641fb8369fc38adaa59dccdc720000000f7678b18b4d1fcd86ae4b35a4fda9cc157062dc1c5ead4c9f66beba95dac823140000000ab1610e36ef1594ebd2c113ccfb177c32e49688d410454e675f0cc1f9e9fbe2836df69f3c2cf8fc901bf49e33d49b3c8eee96b86688c3391bffce48f17e52801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{174D96A1-04E7-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2812 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2812 iexplore.exe
2812 iexplore.exe
2816 IEXPLORE.EXE
2816 IEXPLORE.EXE
2816 IEXPLORE.EXE
2816 IEXPLORE.EXE

pid	process
2812	iexplore.exe

pid	process
2812	iexplore.exe
2812	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2812 wrote to memory of 2816	2812	iexplore.exe	IEXPLORE.EXE
PID 2812 wrote to memory of 2816	2812	iexplore.exe	IEXPLORE.EXE
PID 2812 wrote to memory of 2816	2812	iexplore.exe	IEXPLORE.EXE
PID 2812 wrote to memory of 2816	2812	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03c9d76fc141de0a151cadb3ac5f3af9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0870182fa9510ac6c275fbe862ac85fb

SHA1
f05d11d93b69e34139b0546ac15e4fbe96e51cc8

SHA256
544e0652c8bcee904df0e420a63d27ab40b598451ff7ed8dd874017381f591a8

SHA512
5662ee3b082715ada50b2cbc9ec9c0998eb2a97f6f7136a813b8f2f8aae7376f6e5e72a7d6858adcb1711e87aa784f14fe086f6684eeb6f3f64858a200244aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb30313e3485e673b795da8e6e160dbb

SHA1
b520b341f0136f7c946fc718f5b7ae1c9dbec6fe

SHA256
a4df16e00f5a2960d9a5dfebf02c669c9b7be1e48214bf8bc8306a3f7342b874

SHA512
d356a0b99f03a5f0e589ef24c6ab55bbfb83fc8b8d6ff043833340351abf6f2cdfdd9ce2d4246904872a54b095ef5751b5f4c1000d100e57fe1128750989132b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
447160eaaa0adfd2be56a0be46b40bd8

SHA1
1c82bd98e61ff8e92eec63726c8b3d67681eb8ae

SHA256
618cc9c480bf57c80d92372f930c43ec8cf803d9f129119c36c6d38a6fa948fb

SHA512
df75475606547696403a241bd0dc0d7c2c227aa29c89a5ca83f8ec664c361126ed07a3295e59c51373a7ec3c7a2ad13f8e92c218ce095b26fcd443624f848ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3dbb559466d4fe2f22561c5fc130cf8

SHA1
8b12c31ab9377cab551bff5b6f3b893690f09c37

SHA256
e55ec08991bdf4391a662ad0fa843b702279636702986c0f19d61cfbd002c3a5

SHA512
b5f973cbd77409dcceb563d3f6851be6b7c496097d57e9577881644b68623549665bf56ec9ea8ce780fd321c4a87a046035e8c3bb444346004f43fcad42234a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a019c89c03a96d657070d7969576c02b

SHA1
2ddc45f6883a56c17a13226fa86d2f8147cc0d50

SHA256
06f2b2ff11274bf668662752cf82feb37c0ee0bfc3c2ba456b86f2933fc438d2

SHA512
91ce128a27cbb32c6be25c842c56d1833fc100378a8a654f61f166a8e90ecd4fa803f0d15f952f5f4710227ecb8a10799555ad0b4892d0ff5447bb872e112b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd2185892f1950e4c49c395404631a1f

SHA1
78aa8635830b3208a32fa95ce8afc7fa4c6d1b52

SHA256
6d31a93fa2e97d6ba87f0d73f851d44d5ad124821c71b285d4ebec4b4bb04cb1

SHA512
60c1a166b4e5bc79ab69e59e5dbc3bb763cc48a0dc9b720b0cc0e7fdecee9dfd3c064e059c91e2a1d51c25c6b92d9326e8ba1aa4b630eb16b7981013cb866532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac7ce6a771277ce078f3b317915a44c

SHA1
6d9a8067a8d19182ff29ecda6a5d117057b7a300

SHA256
09cbb907ac26214b97d4155760364173cd4f5f73d9e816aae507cb57a086a934

SHA512
10be621d3442866b6b896a37b02fedc7a21656a4686619222bec4e23b43d863468bc786dfe2ddf2333a84cd40a45d62c2d824bb4eb0175704f0a74c7a3563b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8801209ac7e85de9d7ca526bdf9e31ce

SHA1
58e61041c91cf3905c74a8ee8b159620de40504e

SHA256
9827d3f890d9a676e2a2256c825d557e07dcd68c232cdca86ae2d9693dedb917

SHA512
e18a01d385f5b36f4cd85de84aadae383bdb746fe79044da4b32f433026bc5a33d1ded1977edc66b0c9f80945216754bf21af10704d11ecf11a707fbee456c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf88011d93f0c1b2572bc5773fab98e2

SHA1
c14d8614b0124a5723247ec7b2f2018f0474c0c2

SHA256
271598b28c3dc704c8168e25955bd9da2bbbee8deb45c7442125d8f2ef18ebbc

SHA512
cbc5efdf1c98d89851635d4b12b9f932c9a379732e3040f000d6a3b8f10e6798b7e803f44febf7b7b78acd88474471dcaaaf71b4ae9147b11020db8182d44160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b43103584bcca29e13976bb5a1d432b

SHA1
29065210b43f0fc5a6310d5a6514e66d4866865b

SHA256
43079c0e4bebf5e08eab340614681a05a7b8a2d2c3d30b0db62bcf3364801bfd

SHA512
fd8b8bcc927f826bc16324eb1a99dbbb2f68e82a037cc821c19a90be5bb9cf9f96c6ae936523804502fcc8f4aa0d75d0f236ab16b2eca8326b14aabdc9875e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA453.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit